ConfigServer Firewall CVE-2026-65638

Exploitation requires that an attacker-supplied request URL reach CSF's URL-handling/escaping code path - the CVSS AT:P flag indicates a specific attack requirement, most plausibly that the malicious URL is observed and processed by CSF's log/request monitoring rather than exploited via an arbitrary standalone request. No authentication or user interaction is required (PR:N/UI:N) and the vector is network-based (AV:N). Limiting factors: the deployment must run a version containing the vulnerable code (pre-16.30 on the WebPros fork or the original ConfigServer distribution), and the injection depends on the crafted URL being ingested by the vulnerable component; the impact ceiling (root-level RCE) follows from CSF running as a privileged service account.

The CVSS 4.0 base score is 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N): network-reachable, unauthenticated, no user interaction, with high confidentiality/integrity/availability impact to the vulnerable system and minor subsequent-system impact - consistent with code execution as a privileged service account. The one meaningful limiter is AT:P (attack requirements present), signaling that exploitation is not a single unconditional request but depends on the crafted URL being ingested/processed by CSF (e.g., appearing in a monitored log), which raises real-world attack complexity above a trivial one-shot. EPSS and CISA KEV data were not provided, and no POC is referenced, so there is no evidence of active exploitation or mass-scanning yet; however, given CSF's ubiquity on hosting servers and root-level execution, any operator running CSF should treat patching as urgent regardless of the AT:P caveat. On balance this is a genuine high priority (privileged unauth RCE in widely deployed hosting infrastructure), not a high-CVSS-but-low-impact artifact, though the AT:P precondition means realistic exploitation likely requires triggering a monitored request path rather than a naked packet.

An attacker sends a crafted HTTP request whose URL embeds shell metacharacters to a server fronted by (or monitored by) CSF; when CSF processes that URL without proper escaping, the injected commands execute under the CSF service account. Because that account is typically root-privileged, the attacker gains full command execution on the host and can pivot, persist, or disable the firewall. No public exploit code is referenced, but the injection primitive is straightforward once the triggering request path is identified.